From sommerfeld@sun.com Tue Jan 8 15:19:45 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m08NJiGG003341 for ; Tue, 8 Jan 2008 15:19:44 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m08NJVir023303; Wed, 9 Jan 2008 07:19:41 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JUC00K0BM4Q9M00@nwk-avmta-2.sfbay.sun.com>; Tue, 08 Jan 2008 15:19:38 -0800 (PST) Received: from localhost.east.sun.com ([10.7.251.192]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JUC00JHIM4QRC10@nwk-avmta-2.sfbay.sun.com>; Tue, 08 Jan 2008 15:19:38 -0800 (PST) Received: from localhost.east.sun.com (localhost [127.0.0.1]) by localhost.east.sun.com (8.14.1+Sun/8.14.1) with ESMTP id m08NJbPi001950; Tue, 08 Jan 2008 15:19:37 -0800 (PST) Received: (from sommerfeld@localhost) by localhost.east.sun.com (8.14.1+Sun/8.14.1/Submit) id m08NJbq2001949; Tue, 08 Jan 2008 15:19:37 -0800 (PST) Date: Tue, 08 Jan 2008 15:19:37 -0800 From: Bill Sommerfeld Subject: 2008/014 SHA-2 support for IPsec and IKE To: PSARC-EXT Cc: Dan McDonald Message-id: <1199834377.1678.26.camel@localhost> MIME-version: 1.0 X-Mailer: Evolution 2.12.0 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 X-Authentication-warning: localhost.east.sun.com: sommerfeld set sender to sommerfeld@sun.com using -f Status: RO Content-Length: 1229 I'm sponsoring this self-reviewed case for Dan McDonald and have marked it "closed approved automatic". (Process note: If anyone believes that this doesn't qualify for self-review please speak up ASAP). Description ----------- SHA-2 specifies three secure hash algorithms with outputs of 256, 384, and 512 bits. These are already available in the Solaris Cryptographic Framework, as well as being available in HMAC variants that make them suitable for use in IPsec. This project will enable support for sha256, sha384, and sha512 in IPsec's AH and ESP, as well as IKE. Like previous new-algorithm cases (e.g. 2007/409), the proposed interface taxonomy is Committed, and the proposed release binding is Micro/Patch. The following programs/files that accept algorithm parameters: ipseckey(1M) ipsecconf(1M) ike.config(4) will now accept hmac-sha{256,384,512} and variants. See man page RFEs 6642856 and 6642860. This project will also increase our interoperability with other platforms (e.g. Vista SP1 and Linux), as well as increase our security (hashes are stronger than MD5 or SHA-1). Internet RFCs ------------- RFC 4868 - Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec From sacadmin Tue Jan 8 15:14:24 2008 Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m08NEOVl002538; Tue, 8 Jan 2008 15:14:24 -0800 (PST) Received: (from sommerfe@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m08NEOwG002534; Tue, 8 Jan 2008 15:14:24 -0800 (PST) Date: Tue, 8 Jan 2008 15:14:24 -0800 (PST) From: William Sommerfeld Message-Id: <200801082314.m08NEOwG002534@sac.sfbay.sun.com> To: PSARC-record@sac.sfbay.sun.com Subject: SHA-2 support for IPsec and IKE [PSARC/2008/014 Self Review] Status: RO Content-Length: 567 Template Version: @(#)sac_nextcase 1.64 07/13/07 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: SHA-2 support for IPsec and IKE 1.2. Name of Document Author/Supplier: Author: Dan McDonald 1.3 Date of This Document: 08 January, 2008 4. Technical Description See the case directory for more detail 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: Automatic 6.6. ARC Exposure: open